wordpress-penetration-testing
以证明与修复为目标的安全流程，强调授权与范围控制，适合合规测试团队。
必须有书面授权且可能执行破坏性测试，存在法律与运行风险。
面向授权场景的 WordPress 渗透测试编排，覆盖侦察到修复建议全流程。
做授权范围内的 WordPress 渗透测试编排，从侦查、枚举、认证/权限测试到漏洞验证和修复建议一条龙覆盖。会组合你现有的工具（WPScan、ffuf、Burp、semgrep 等）按流程执行并产出以修复为导向的报告。特别强调安全与可复现：每次跑之前读 LESSONS.md，跑完把新发现记录成经验让下次更高效。
▸ 展开 SKILL.md 英文原文
Authorized, defensive-minded WordPress penetration testing — end to end and EDITABLE as it learns. Recon → enumeration → auth/access-control → vulnerability testing (core, plugins, themes, config, REST/XML-RPC) → in-scope validation → remediation-focused reporting. A lean orchestrator over the tools you already have (WPScan, the `ffuf` skill, Burp via `trailofbits-security/plugins/burpsuite-project-parser`, `static-analysis`/`semgrep-rule-creator` for plugin/theme code review, and E-Lego's Elementor security-audit branch). AUTO-LEARNING BY DESIGN: it reads its own LESSONS.md before every engagement and captures new findings at the end, so each run makes the next one sharper.
帮我安装这个 skill：https://raw.githubusercontent.com/dxxx/Bot-OS/main/skills/wordpress-penetration-testing/SKILL.mdcurl -fsSL "https://raw.githubusercontent.com/dxxx/Bot-OS/main/skills/wordpress-penetration-testing/SKILL.md"# WordPress Penetration Testing > Authorized, defensive security testing for WordPress. The goal is **find → prove safely → > remediate**, not exploitation for its own sake. Everything here assumes you have written > authorization and a defined scope. ## ⛔ Authorization gate (STOP — do this first, every time) - [ ] **Written authorization** exists for these exact targets (domains/IPs/subdomains), signed by someone empowered to grant it. No authorization → **STOP**, do nothing. - [ ] **Scope + rules of engagement** are defined: in-scope hosts, out-of-scope paths, allowed test windows, rate limits, whether destructive/DoS tests are permitted (default: **NO**), and data-handling rules. Templ